One line of work regards AEs as statistical outliers. Some of them propose to train a binary classifier to learn the statistical differences between the distribution of clean data and that of the AEs [1]}, [2]}, [3]}, [4]}, [5]}, [6]}, [7]}, [8]}.
In particular, Aigrain et. al. [4]}, Feinman et. al. [5]}, and Metzen et. al. [3]} use the intermediate representations from a pre-trained classifier to train the detector. Local Intrinsic Dimensionality (LID) [7]} estimates a so-called LID value, i.e., the distance of the input and its neighbors, and detects AEs with large LID values. The above works train the detector with both legitimate and adversarial data in a supervised manner, and hence they are usually less effective for adaptive attacks.
